Skip to content

integer overflow in network.c #20601

Closed
Closed

Description

@chongwick

Description

The following code:

<?php
function section($v_14574,$v_14575,$v_14576,)
{
$v_14574 = $v_14574;
$v_14575 = $v_14575;
$v_14576 = $v_14576;
$v_14577 = "\n------- $v_14574 -----------\n\n";
$v_14579 = 0;
$v_14580 = 3;
$v_14581 = 6;
$v_14582 = 9;
$v_14583 = 11;
$v_14584 = 12;
$v_14585 = 1;
$v_14586 = -($v_14585);
$v_14587 = 3;
$v_14588 = -($v_14587);
$v_14589 = 6;
$v_14590 = -($v_14589);
$v_14591 = 20;
$v_14592 = -($v_14591);
$v_14578 = array(0 => $v_14579,1 => $v_14580,2 => $v_14581,3 => $v_14582,4 => $v_14583,5 => $v_14584,6 => $v_14586,7 => $v_14588,8 => $v_14590,9 => $v_14592,);
foreach ($v_14578 as $offset){
$v_14594 = $offset;
$v_14595 = "> Offset: $v_14594\n";
try{
$v_14599 = func($v_14575,$v_14576,$v_14594,);
}
catch (ValueError $e){
$v_14596 = $e->getMessage();
$v_14597 = PHP_EOL;
$v_14598 = $v_14596 . $v_14597;
}
}
$v_14593 = $offset;
}
try{
$v_14999 = '127.0.0.1';
$v_2741 = PHP_INT_MAX;
$v_2742 = 3;
$v_2743 = intdiv($v_2741,$v_2742,);
$v_2744 = var_dump($v_2743,);
$v_15003 = ftp_connect($v_14999,$v_2744,$v_2741,);
}
catch (ValueError $exception){
$v_14996 = $exception->getMessage();
$v_15004 = '127.0.0.1';
$v_14998 = $v_14998 . $v_15004;
}

Resulted in this output:

/home/w023dtc/nightly_php/php-src/main/network.c:320:21: runtime error: signed integer overflow: 1764255369 + 9223372036854775807 cannot be represented in type 'long'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/w023dtc/nightly_php/php-src/main/network.c:320:21

PHP Version

nightly

Operating System

No response

Activity

  1. chongwick commented on Nov 27, 2025

    @chongwick
    Author

    reduced reproducer:

    $v_15003 = ftp_connect(14999,4,PHP_INT_MAX,);
    
  2. self-assigned this
    on Nov 27, 2025
  3. added 4 commits that reference this issue on Nov 29, 2025
    1701589
    227541c
    71d11bd
    4312a44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions